3f5f73872b4d5428284650808451a9e58e61dbb0155343e137a16b636caf8fcd

Analysis

max time kernel
7s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df7b11069101344adc5211ecee714b7.exe
Size

266KB
MD5

0df7b11069101344adc5211ecee714b7
SHA1

d747e3138dc7ec854a7db52892894d54c838cd2a
SHA256

3f5f73872b4d5428284650808451a9e58e61dbb0155343e137a16b636caf8fcd
SHA512

3fb040a4fa99ec8f5dc6c50ff20cd0353fe645574aa90b1b3ea903f1b636eb535deb11496a32bb27f06ea6b7b96ddb6ca69ebeaa90dd9445db36e1e67d5a29cd
SSDEEP

6144:LEiPwhjJtNdZGxNk2cNlt0KCorzk9xOFSTYgnPQ:giYDoMlprzk9x9YV

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2244	0df7b11069101344adc5211ecee714b7.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	0df7b11069101344adc5211ecee714b7.exe

Loads dropped DLL 1 IoCs

pid	Process
2648	0df7b11069101344adc5211ecee714b7.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2648-13-0x0000000001490000-0x0000000001516000-memory.dmp	upx
behavioral1/memory/2244-17-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/files/0x00100000000133bf-15.dat	upx
behavioral1/files/0x00100000000133bf-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2648	0df7b11069101344adc5211ecee714b7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2648	0df7b11069101344adc5211ecee714b7.exe
2244	0df7b11069101344adc5211ecee714b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2244	2648	0df7b11069101344adc5211ecee714b7.exe	20
PID 2648 wrote to memory of 2244	2648	0df7b11069101344adc5211ecee714b7.exe	20
PID 2648 wrote to memory of 2244	2648	0df7b11069101344adc5211ecee714b7.exe	20
PID 2648 wrote to memory of 2244	2648	0df7b11069101344adc5211ecee714b7.exe	20

C:\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe
"C:\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe
  C:\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe

Filesize
48KB

MD5
d01f3e642cfb623072bf992585a36dbe

SHA1
6558ff174d62fcc1d36f610ee5e3e57a7eb8674a

SHA256
7eb0709bb9a217ee9ff67b58fefb10ae9c3dda62d26e0364c547152d760500c6

SHA512
00ecca7c7f3c0a43bb37748b40bb8f21fa0f721f4ffcbed2d06f663acec0867befc8687b66dc71b7192d25b3f50f2c03c9b6e0c1c8a78343f6e1152204e2bb7e

Download Submit
\Users\Admin\AppData\Local\Temp\0df7b11069101344adc5211ecee714b7.exe

Filesize
21KB

MD5
7076a20d22ca582b811d7e1cf3a4e992

SHA1
d40babc09197d08ab87a955f021a66ca96b97e35

SHA256
86712a99e30c408499ce31f76b1d19cc723f971304d130bdf8837d308a02707c

SHA512
2bcfc27df1a9ee2f473f60bbe6d444f9dcea94da8a02550f48093ea4489c45ca73bce47e06cf080e0ddddada84f7cd270b1e39f506e87b9f360739971f12e0bd

Download Submit
memory/2244-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2244-19-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2244-43-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2648-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2648-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2648-1-0x0000000000150000-0x0000000000171000-memory.dmp

Filesize
132KB

Download
memory/2648-13-0x0000000001490000-0x0000000001516000-memory.dmp

Filesize
536KB

Download
memory/2648-16-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download